Queensland Consolidated Regulations Queensland Consolidated Regulations(1) An IAP service provider must prepare, and make publicly available, a document that sets out its policies on the management of personal information held by it.
Examples of how a document is made publicly available--
making a document available at an office of the IAP service provider
making a document available on the IAP service provider's website
Maximum penalty--60 penalty units.
(2) If asked by an individual about whom an IAP service provider holds personal information, the IAP service provider must, within 28 days after receiving the request, give the individual the following information if the IAP service provider can reasonably give the information--
(a) the kinds of information the IAP service provider holds about the individual;
(b) the purpose for which the information is held;
(c) the way in which the IAP service provider collects, holds, uses and discloses the information;
(d) the persons and entities to whom the information may be disclosed;
(e) that the collection of the information is authorised under this part;
(f) that, under this part, the individual has rights of access to the information or to have the information changed to ensure it is accurate, up-to-date and complete;
(g) how the rights mentioned in paragraph (f) can be exercised.
Maximum penalty--60 penalty units.
(3) An IAP service provider does not commit an offence against subsection (2) if--
(a) it is not possible for the IAP service provider to give the individual the information required to be given under subsection (2) (the required information) within 28 days after receiving the request; and
(b) the IAP service provider--
(i) within 28 days after receiving the request, gives the individual an interim reply that--
(A) gives the individual as much of the required information as the IAP service provider can give within the 28 days; and
(B) states the reason the IAP service provider can not give the individual the rest of the required information; and
(C) states an estimate of how long it will take the IAP service provider to give the individual the rest of the required information; and
(ii) as soon as possible after the interim reply is given to the individual, takes reasonable steps to give the individual the rest of the required information.
(4) An IAP service provider must, if asked by an individual about whom the IAP service provider holds personal information, give the individual access to the personal information without undue delay or cost.
Maximum penalty--60 penalty units.
(5) Subsection (2), (3) or (4) does not require an IAP service provider--
(a) to inform an individual that a report under section 55T or 55U exists or has been made; or
(b) to give an individual access to the report.